Strong enough to trust. Simple enough to use.
A serious tool for the things you can't afford to lose — engineered end to end, and open to inspect down to the last constant.
Sealed in about five minutes — no technical knowledge needed.
Encrypted on your device. We never see your files or hold a key.
Openable for decades — even if Lastnote is gone.
Sealing the vault
How a vault is locked — the cryptography that gives it no single point of failure.
In-browser encryption Everything encrypts on your device. We never see plaintext — ever.
Your browser generates a 256-bit master key locally, derives AES and filename keys via HKDF-SHA256, and encrypts every file with AES-256-GCM — assembling the vault file entirely in memory. The master key is destroyed when sealing finishes. There is no Lastnote employee who can decrypt your vault, no court order we can comply with, and once a vault is sealed, no breach of ours can expose it.
Secret key sharing No single piece reveals anything about your key — and that's proven, not just made hard.
This is Shamir Secret Sharing — public mathematics since 1979. The master key is split into N keys (their formal name is shares) over the prime field GF(2²⁵⁷ − 93). Any K keys reconstruct it; fewer than K reveal nothing about it — not 'hard to crack', but mathematically nothing, as a proven guarantee. Each key is one point on a random degree-(K−1) polynomial whose curve is the master key; with too few points, infinitely many curves fit equally well, so no attack beats guessing.
Set your own threshold Choose how many pieces exist, and how many it takes to open — sensible defaults a tap away.
Pick N up to 20 and K anywhere from 2 to N. The wizard shows the consequence in plain English ('any 3 of 5 · tolerates losing 2'), so the trade-off between resilience and concentration is visible before you commit. Sensible defaults are one number away: 3-of-5 for most people, 2-of-3 for tight circles, 4-of-7 for high-value vaults with diverse storage.
Handing it out
What you do with the pieces — the kit that turns ciphertext into custody.
Distribution Kit One organised zip at seal time — every document, sorted by who it's for.
When sealing finishes you download a single structured zip with three folders and a plain README: for-trustees/ — one bundle per trustee; for-recovery/ — the recovery pack, holding the Recovery Packet, the Codex, and an optional copy of the vault file; and for-me/ — an Owner Memo (a private snapshot of who got which key), your own keys, and a printable checklist to tick off as you hand things out. The post-seal steps walk you through distribution, then prompt you to delete the kit — because the vault's protection is the physical and social separation of its parts. The kit makes that separation happen, then ceases to exist.
Key certificates A printable, QR-coded pack per trustee — they can act on it alone.
Each trustee gets a PDF with their key value, a QR code of it, the vault and owner names, the quorum ('key 3 of 5, threshold 3'), and plain-English instructions — including how to verify whoever asks for the key back. Generated client-side with pdf-lib, one per key, with a .txt alongside for when paper isn't right. A trustee never needs this site.
Recovery Packet The recovery playbook — what the vault is and how to open it.
A single non-technical PDF for the person who will pull recovery together: what this vault is, what to do, both recovery paths, and the private recovery key on its own page designed for sealed-envelope storage. Written for someone with no technical background, possibly opening it years later while grieving. Hand it over once; forget about it.
Recovery Codex A booklet that decrypts the vault with Python alone, if we vanish.
A printable booklet that travels with every vault: the full format spec, a single-file Python script that decrypts it, and a worked example. A trustee with a threshold of keys hands it to any competent developer and recovery is one afternoon's work — no Lastnote required.
Sovereign recovery Storage options Keep your own copy, store with Lastnote, bundle with your trustees — combine freely.
Keys are useless without the encrypted vault file, but a single copy is a single point of failure and a pure-cloud copy re-centralises everything. So Lastnote lets you combine storage paths freely — keep your own copy, store with Lastnote, and bundle a copy with your trustees — and most owners use two or three. The file itself is AES-256-GCM ciphertext that leaks nothing without a threshold of keys.
Extra protection
Optional upgrades for higher-value vaults — bind a key or a sensitive action to physical hardware.
Hardware-key protection Wrap a key to a YubiKey, so a photographed certificate is useless.
A paper certificate has obvious failure modes — a photo leaks it, a fire destroys it, a relative reads it. Any trustee can opt their key into hardware-key protection: enrol a FIDO2 key once, and the key is stored as ciphertext only that physical key can decrypt. At recovery they plug in, touch it, and the browser unwraps locally before submitting. WebAuthn PRF derives a 256-bit secret from a per-trustee salt that never leaves the key.
Passkey sign-in Face/Touch ID or a hardware key as a phishing-proof second factor.
Email magic-links are only as strong as your inbox — fine for routine actions, not for sensitive ones (triggering recovery, deleting a vault, changing a trustee's email). Add a passkey — Face ID, Touch ID, Windows Hello, or a YubiKey — and Lastnote requires it for those. Standard WebAuthn; credentials are public-key handles only, private keys stay on your device. Enrol multiple devices so losing one isn't catastrophic.
Keeping it healthy
How it stays alive over the years — quiet, optional, turn-on-once automation.
Reopen and edit it yourself Keep your own set of keys, so you can update the vault anytime — without gathering anyone.
A sealed vault is normally openable only by your trustees together — not even you. But real life changes: accounts, passwords, wishes. So you can optionally keep your own set of keys (default 2 of 3, an independent split that never touches the trustee pot), printed in the kit's for-me/ folder. With them you reopen the vault, edit its contents, and re-seal — all on your device, keys-only, no passphrase. Because it re-seals under the same master key, every trustee's key still works and no one is re-issued. Leave it off for a pure 'sealed until I'm gone' vault; turn it on when the vault is something you'll keep tending.
Wellness check-in A gentle one-click 'still here?' on the cadence you set.
The hardest part of inheritance is not crypto — it is noticing. On a cadence you set (monthly by default), Lastnote emails a one-click 'still here' link. Miss one and a grace period of daily reminders begins; if it ends without a check-in, recovery starts automatically — and you can cancel and reset right up to that point, even after, if you return in time. The session is created only when grace actually exhausts, and the urgent notice sent only after, so you are never told recovery is happening when it isn't.
Trustee management Invite, accept, revoke, replace — cleanly, with an audit trail.
Naming five trustees on day zero is easy; the lifecycle is the hard part. Invite-by-email lets a trustee accept without learning anything about the vault until they do. Each invite is a single-use magic link with a 14-day life; accepting creates an account holding only their key relationship. Revoke withdraws an unaccepted invite; replace re-issues a single lost key without re-sealing the whole vault. The owner sees per-key status; the trustee sees only their own vaults.
Trustee heartbeats Confirm each key still exists — before drift becomes a crisis.
A trustee can lose a key quietly. Every six months or so (cadence set at creation) each gets a one-click email with three buttons — still have it, lost it, or pause for 30 days. The owner's dashboard updates with colour-coded dots keyed to key number, not identity: green confirmed, amber paused, accent lost, neutral pending. You see drift early and can re-issue any lost key without re-sealing.
Owner dashboard Every vault, trustee and signal on a single screen — no menus to dig through.
All those signals — check-in state, heartbeat replies, trustee status, cloud-storage, recovery contact — are useless buried. One screen per vault puts the wellness badge and its countdown ('3 missed · 27 days grace left') at the top, with per-key trustee rows below. First-class buttons (check me in, send heartbeats now, invite a trustee, begin recovery) replace nested menus. The point is to glance, see green, and close the tab.
Opening it
How it opens — several paths to the same plaintext, for whatever the day holds.
Hosted recovery Trustees send their keys by private link, the recovery trustee watches it come together — no one has to meet.
Asking people in different cities to be in one room is the friction that kills threshold systems. Instead, Lastnote emails each trustee a private link to a single page: drop the vault file, paste the key, submit — the browser encrypts it to the vault's recovery key and sends only ciphertext, with actionable errors if a key is mistyped. The recovery trustee watches a live, sign-in-free dashboard: how many keys are in, which slots are still waiting, and the moment the threshold is met — when the bundle unlocks to download and decrypt on their own device. No trustee learns who the others are; the relay routes ciphertext only and never holds a key, and they can cancel if the owner reappears.
Offline reconvene Trustees in one room, no internet, no relay — the most robust path.
For high-value, high-trust vaults, bringing people physically together is the most robust path against social engineering — everyone verifies everyone in the room. Trustees gather, each provides their key (read aloud, hand over the certificate, scan the QR), and a trustee opens the recovery page, drops the vault file, and pastes the keys. The page is fully static — it runs from a USB stick on an air-gapped laptop — combining the keys via Lagrange interpolation and catching typo'd keys with a SHA-256 check before any decryption.
Begin recovery now Owner-initiated trigger — start recovery any time, cancel any time.
Sometimes you want recovery to start without waiting for the wellness timer: you are going somewhere unreachable, or you simply want to test the path before relying on it. The vault dashboard's 'Begin recovery now' button creates a session immediately — the same flow as the timer firing — and you can cancel any time before the recovery trustee claims the bundle. Recovery is not a one-way door.
Recovery without us Open the vault with no Lastnote, no network, no live service at all.
This is the path that has to work when nothing else is left — Lastnote gone, the website down, years later. It needs nothing from us: the published format spec and a threshold of keys are enough for any competent developer to decrypt the vault with standard cryptographic primitives. Everything required travels inside the vault and its Recovery Codex — no server to call, no account to recover. It produces the same plaintext as the hosted and offline paths, just with the company subtracted.
Sovereign recoveryKeeping it honest
How it stays inspectable, testable, and yours to walk away from.
Open specification Every constant published — salts, info strings, nonce length, field prime.
A spec that says 'we use AES' is not a spec. Every parameter Lastnote uses is declared explicitly, both in the docs and inside each vault.json blob, so a recovery tool reads what it needs from the file itself — no hidden magic values. The spec, the reference Python, the TypeScript crypto core, and the test fixtures are all in the repository, with cross-implementation tests on every release.
Sovereign recovery Recovery, tested every release Every release, our build runs the published recovery procedure against a real vault — or the release is blocked.
A recovery promise is worthless if it quietly stops working. So an immutable fixture vault lives in the repository, and every release runs the single-file Python script — the exact one shipped in the Codex — against it and checks the plaintext still matches. Change a key-derivation parameter without updating the spec, and the decryption breaks and the release is blocked. The recovery path stays honest by force.
Sovereign recoveryA brief seal. A long quiet. A possible reconvening.
Most of a vault's life is spent doing nothing — that's the deliberate shape of it. Everything above is built to survive the years between the day you seal it and the day a quorum has reason to gather.
Seal your first vault.
Your files, your people, your keys — about five minutes, and nothing leaves your device that we could ever read.